VULNERABILITY INTELLIGENCE

CVE-2025-9345

CVSS score4.9 MEDIUM

EPSS probability0.50%

CISA KEVNot currently listed

Published2025-08-28

Last modified2026-06-17

Description

The File Manager, Code Editor, and Backup by Managefy plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.4.8 via the ajax_downloadfile() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform actions on files outside of the originally intended directory.